5bb2af4f0e70623e1ce277a4cd0c0c27e51890541e34f0e9a1e5b81ce4a12324

Analysis

max time kernel
1386s
max time network
1174s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
14-04-2024 20:51

Target

$PLUGINSDIR/GetVersion.dll
Size

13KB
MD5

ae85debc48eee67767735e22fbcabd4f
SHA1

7816874fb0ac1636ef405ac10d726835cdc9619b
SHA256

bb7e0835019c837df5bce018cafd29efd179ac92530c92f42bc55dca6848a203
SHA512

01f7108b63d0aef3ef49e851a1a6738d5a02e4e1505bebe81a96fc48304faaa79cc1e0b6c9479175d349461d3995a6d7ecf2fab49799e3521491f306bfeef07b
SSDEEP

384:E384+Nsc2AaCHhZwpAK8UbN5bLoyci2SUQpeiBfPJc44Bi46AQ5VuDgR:E3mpK3bLoyci2SUQNm0

Score

3^/10

Program crash 1 IoCs

Processes:

WerFault.exe

pid	pid_target	Process	procid_target
856	1220	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	Process	procid_target
PID 4916 wrote to memory of 1220	4916	rundll32.exe	85
PID 4916 wrote to memory of 1220	4916	rundll32.exe	85
PID 4916 wrote to memory of 1220	4916	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\GetVersion.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\GetVersion.dll,#1
  2⤵
  PID:1220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 612
    3⤵
    - Program crash
    PID:856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1220 -ip 1220
1⤵
PID:1648